After having tried to software-hack my old Flir E4 to get a higher resolution, and failed at that (some of them cannot be upgraded for unknown reasons), I was on the lookout for a better resolution device.

Almost all the other cheap off-brand imagers i have seen is pretty crap, but this one boasting a resolution of 220×160 pixels, that’s not half bad (compared to my old Flir E4, which was locked down at a measly 80×60 pixels.

This reveals that the camera uses a sensor module from SEEK thermal and reveals some other nice details. Go see his video on how to get into the device.

It looked good, so i ordered one using the link on Julian’s video. After approx 3 weeks (whereas one week was it being stuck in customs) it finally arrived. I turned it on and checked that all worked, and then to continue to take it apart 😀

This is not a review, nor a teardown. This has been done before. I will look into what’s happening on the serial interface that is clearly evident on the board, and i will try to figure out what kind of communication protocol there is between the sensor and the mainboard.

The mainboard in all its gory details. All pictures are clickable for magnification.

Apparently the mainboard is a quite new revision (August 21, 2018), and not carrying a CPU-daughter board like on The Equalizor‘s camera.

Looking at the mainboard, trying to figure out how everything is wired together, it becomes apparent that there is a room for a module of some kind, denoted U5. Hmm, GPS-module for geotagging or WiFi-module? The traces going off to J1 with the antenna matching components screams WiFi to me. Who makes a WiFi-module in this approx. 12x12mm footprint? EDIT: I found it, using the right search words on AliExpress: “Tablet WiFi module” – It’s a module carrying the RTL8188CUS WiFi-chip.

What is interesting, when we follow the tracks from this missing U5 module, they go to a missing U7 chip. The data pair from the thermal module also goes here, but is jumpered by two 0Ω resistors (R28 & R29) … Hmm this smells a lot like USB! – What is U7 was a missing USB-hub? I’m thinking GL850G in SSOP-28 housing, a good old classic. A datasheet is available here: GL850G USB Hub 1.07.

So, we know that the thermal imager is running USB communication with the main Allwinner A33 CPU. No need to put the logic analyzer on these lines for hacking – we need to look at that serial port to see what’s happening on boot!

The cable between the sensor and the mainboard, Front and back view.

It carries GND, +3.3V and USB data.

The sensor module itself:

Front of the sensor has a removable lens, held in place with two daubs of what seemed to be hot-melt adhesive. It was easily removed with a scalpel. I am planning to design and 3D-print a tool that fits into the holes in the front to be able to set the focus.

The processor on the thermal module is the NXP LPC4330FET100, a Dual-core Cortex M4/M0 chip. More info here

The camera module is a sandwich of two boards – front board holding the directly bonded sensor (this is pure speculations)

Bottom side of main PCB with the NXP micro holds some support circuitry and a big SPI flash that holds the firmware that runs the module.

On top of the main board, in vicinity of the thermal module there is U100, it’s a bog-standard DS18B20 thermometer for local compensation of the camera’s own temperature. I guess the thermal module does not carry its own temp. sensor.

Some playing around with booting the board without thermal imager or visible camera modules revealed that with both unplugged it will hang indefinitely at the boot screen (but it will still switch off when you press the power button, so it’s not dead behind the scenes). Unplugging only one of the cameras/sensors will have the camera booting happily. Unplugging the visible camera makes all mixed image modes go black. Unplugging the thermal module makes all thermal readings go away, but you can still use the visible module just fine. I guess it was built this way to not die completely if one of the devices went bad, but instead would boot and the user could see what was missing, to go report the error and get the device off for repair.

On the back of the board there is a switch, S1. I tried pressing it while the unit is in operation, no response.

Holding it down while pressing power button yields a device that does not boot, but rather “locks up” – I’m pretty sure this button is to go into some bootloader flash mode. The firmware talks about a “fel button” – it’s for firmware flashing as far as i know for now.

Well this is getting interesting!

The small connector footprint J2 showed to contain no output at all, i scoped it and it’s dead as a dodo.

The three test pads over it on the other hand is alive and well with debug serial@115200 8N1 – YEAH!

Booting the camera with all devices connected will yield this nice bootlog:

The rest is not shown here, open BOOT down here under to see the full bootlog.

Raw logs from boot can be found here – some of them is booting without imagers connected, just to see how it reacts:

System is running Busybox, and with some serial debug magic i managed to copy files from system folders to the /mnt/IMGS folder that is exposed over USB. I found all kind of good stuff there – in /boot/ i found logos for other manufacturers (different branding), the cheesy battery recharge-animation – even audio files though the system has no way of doing audio recording or playback 😀

I decided to order in a WiFi-module and USB-Hub-chip so i can enable WiFi and SSH-access on this 🙂

— I will update this when the parts arrive.

While attending the 2017 edition of Mini Maker Faire at Aarhus central library (DOKK1) We (Labitat expedition) also went to the obligatory visit at OSAA (Open space Aarhus) and looted some stuff from their Limbo-shelves.

In between all the good stuff there, I found a Sony BDP-S360 BluRay-player. It went back home for exploring.

Upon powering-up it just sits there saying “Wait” on the VFD while making some mechanical noises.

As I have no interest in having a BD-player it was turned into parts. Nothing really useful was found inside. Bog-standard primary SMPS, 22 watts max output and mainboard with more or less single-chip-solution.

The mechanics had the old venerable KES-410-optical pickup (known from the ‘PS3 fat‘)

As I have a special interest in VFD’s (Vacuum Fluorescent Displays) (amongst other older display technologies) I took a closer look.

It has all the power supply circuitry onboard directly – usually the Filament-drive and VEE-supply is built-in in the main SMPS, but Sony apparently went for the simpler approach here. I like that!

2 minutes on Google yielded the service manual with nice schematics and pictures of the front panel-board foil and silkscreen.

Looking at the schematic for the power supply for the VFD it’s pretty bog standard-kinda-deal here.

Transformers have always been an interesting item – for most a “black box”. I would like to know the number of windings etc. So i took out the transformer, put it into Acetone for a minute and opened the core (the outer ring lifts off, revealing the windings.)

I documented my findings here, in case that it might come in handy for someone else hacking with VF-Displays

T701:

Circular core, 10 pins.

Primary, pins 2,3,4

Feedback, pins 5,6

Secondary, VEE 1,10

Secondary, Filament 7,8,9

Tested at 160kHz

Primary inductance (end-to-end) 70 uH

Feedback inductance 2.2nH

Secondary, VEE 140uH

Secondary, filament 3uH

Winding order:

15+15 Windings 2-3-4 0.1mm

3+3 Windings 7-8-9 0.1mm

44 Windings, 10-1 0.1mm

5 Windings, 5-6 0.1mm

Voltages measured:

VEE is -18V

Filament supply is 5.4Vpp running on a -13.7V bias

Switching circuit runs at 216 KHz

The VFD-glass itself seems to be custom-part with special symbols for BD-player. I couldn’t find anything online on it.

The controller on board is the old and venerable PT6315. It uses a 3-wire interface and is very easy to interface with.

I will keep the board and parts for some more fun another day.

Update:

For kicks i tried making my own transformer on a EP-7 core with PC40-material.

I am in the process of installing a Nexus 7 Tablet permanently in my Car – Using it for Navigation software and playing music.

I need to be able to tell the Nexus 7 to pause playback of music, and go to sleep. The easiest and most simple way is to touch a NFC tag to it, that tells it to do just this (Using a combination of NFC Task Launcher & Tasker)

But, how to enable the tag at will ?!

Solution: Put a CMOS switch in series with the antenna of the tag – this way it will only be readable when i tell it to!

A good solution is the 74HC4066 or even the DY411DY, but those are just too big an complicated. Why not resort to a single CMOS switch – Enter the 74LVC1G66.

A small SOT353 device that does it all, albeit a bit small for most soldering irons, but nothing my Weller WD1000M can’t handle.

I drew up a board in Eagle cad and milled a PCB. It didn’t work in the first try, it seems I damaged the RFID chip when removing it from the blob of glue inside the tag, so next chip i mounted sits on a big glob of glue, no need to risk damaging another chip!

I the second try, it works perfectly! – The chip needs a supply voltage of 3,3 or 5V and a logic high signal to trigger the Tag “ON”

Recently, i purchased a big lot of Philips ZM1000 Nixies, and needed a test PCB to test out if all was good – i got sockets for a number of the tubes, so i settled on making a PCB with the correct socket, so I easily can test them.

Being fond of the Arduino, i just thought, why not make it an Arduino shield – this way it’s a nice compact solution, powered by the USB-port, and no extra cables needed.

I earlier on aquired one of the real nice high voltage supplies, perfect for nixies from Taylor Electronics

So i made a single PCB that fits the small power supply module, a socket for a 74141 Nixie driver, and a socket for the ZM1000 tube.

I milled the PCB on our PCB milling machine in the local hackerspace where i frequent, Labitat

I did not mount all the headers on the finished PCB, since they are not in used. The use of stacking headers are a little waste, since there is no way I can mount anything on top of the Nixie PCB, but they make the PCB headers more mechanically stable, since they are soldered on on the bottom side of the PCB.

A small video of the circuit in operation, running a simple counting program, testing all digits: Youtube

A member of Labitat, [Kulitorum] donated around 50 telephones to labitat since his work place scrapped them.

I took one of the phones home to reverse engineer the LCD. After about 10 minutes with the logic analyser, it was clear that it’s based on the Hitachi HD44780 or compatible controller.

Just connect the contrast pin to GND, then contrast is perfect for most projects – unfortunately the LCD is meant to be viewed from an angle, and is not good for a front panel etc. that you will view front-on.

Was cleaning out in the shed today, and found an old piece of kit, some kind of controller box from Evans & Sutherland with 8 encoders and 8 pcs. 8-digit LED readout

The Display units are intelligent Alphanumeric LED readouts, have to do something with them some day… Anyway, the encoders is HP QEDS-7596, enclosed optical encoders, 512 pulses per revolution. Very nice encoders, must have cost a small fortune!

Wired it to my Arduino (yep, still playing with it, hehe) and opened a serial terminal to see the position of the encoder wheel, works nicely, the resolution of these encoders are just insane.

Googled around, i wanted to show the result on my computer (i’m using a Mac) and have read about processing, but never tried it. Now i had a reason to try it out.

Downloaded it, and got it running in a few minutes, it’s just as plug and play as the arduino, very nice!